1. Field of the Invention
This invention relates to methods and devices for the safe and secure operation of host information systems which must exchange information with other information systems and devices, such as in cyberspace and, where such external systems may be corrupted in some manner, utilizing system architecture and data signal transformations as opposed to conventional software based firewalls to receive and convert or reformat incoming information signals from the external systems and thereafter extracting and supplying only non corrupted information signals to the host systems. The invention also provides for screening of outgoing information signals from the host systems to prevent unauthorized information exchange and for permitting secure updating of host systems files with information before updated files are returned to the host systems.
2. Description of the Prior Art
The field of information-system security (InfoSec) technology and practice to date has focused on controlling human user access to computer system resources, and preventing hostile, clandestine computer programs, such as computer viruses, from corrupting a computer system. The advent of the Internet and personal computers brought new challenges to the InfoSec field, particularly because in networks, other machines, not human users, were the entities that primarily accessed a computer system. Old, pre-network, password usage and similar software authentication methods only offered a modicum of security control at xe2x80x9cauthorized userxe2x80x9d entry points of a network. Intruders could bypass these methods as they do in today""s Internet and tap or hack (i.e. the term hackers) into the communications segment of a computer network and launch any form of mischief or disruption that the target network would allow. This is the core of today""s Internet security problem, wherein intruders can disrupt nearly all forms of Internet activity, from disabling web sites and compromising message traffic, to falsifying identity. The conventional InfoSec problems of unauthorized user access, incorrect operation, and system malfunction remain, in addition to today""s network oriented security problems.
Various schemes of varying degrees of complexity and convolution have been devised to provide needed security. Examples of two of the latest of such schemes are U.S. Pat. Nos. 5,623,601 to Vu, and 5,632,011 to Landfield, et al. The methods taught are implemented as software computer programs, which operate with or as a standard operating system software package. Assumed in the methods are the correct implementation and operation of these software packages, and the operating system (i.e. control software) with which it must operate. Here, xe2x80x9ccorrect operationxe2x80x9d also includes InfoSec correctness which means no compromise to a hosting system is precipitated by the operation of such software. Proving or verifying such assertions as software correctness, or software operational integrity remains a major barrier in InfoSec technology, as well as in computer science and engineering in general. Software verification is a formidable undertaking. Finally, software (i.e. computer programs) is vulnerable to compromise by other computer programs, which may include viruses. Software attack and corruption, whether e-mail packages, protocol modules, operating systems, macro services such as OPEN commands, etc. is the realm of the system/network intruder (the Hacker). The ideal InfoSec tool should not be software dependant.
Today""s InfoSec tools such as the above cited references implement, in software, a type of gateway function. The term firewall is often used. A gateway is a computer that connects two different networks together. A firewall is a gateway with the additional constraints and properties that all inter-network traffic must pass through it, whereby all unauthorized (according to some rule-set or security policy) traffic is prevented from passage. The firewall must operate correctly and be free from compromise. To further compound this difficulty, firewalls are filters. As such they must allow selected external traffic to pass through to the system or network being protected, especially if useful information exchange between the systems and networks separated by the firewall, is to take place. Firewalls have no way to filter out hostile traffic, without prior knowledge of such traffic. Also, service packages, such as e-mail, containing corrupted command macro programs (e.g. macro viruses) are impervious to firewalls. Possible legitimate bit configurations in command fields of standard message traffic passing through a firewall could trigger disruptive events, when entering a protected system or network. Firewalls, acting as an address translation proxy for an inside/protected system or network, can protect that system or network from exposure, to an external system or network, of its internal and critical address information. Again, one assumes (usually, without rigorous basis) correctness of the proxy software function.
Although firewalls and anti-virus software are steps in the right direction, more universal protection of information systems or networks is needed, whereby such protection is easily verifiable, cost-effective, and does not require xe2x80x9capriori knowledgexe2x80x9d to successfully execute a detection and/or filtering function, and is software independent.
The present invention is directed to the use of a computer hardware device which functions as an inter domain screen or signal processor hereafter referred to as the IDS. The IDS is a unique data flow control architecture and device family, within which two unique processes are executed. The IDS protects its host system from compromise from any external connections. The IDS contains an intermediate-domain-device (IDD), sockets which connect the IDD to the host system, and sockets which connect the IDD to external domains. External domains, which are to exchange information with the host, are prevented, by the IDS from compromising the host. The intermediate domain (embodied by the IDD) is a special purpose domain for information exchange. The purpose of the IDS is to permit maximum information interchange, while preventing external signals from directly entering a protected domain or host. The term xe2x80x9chost systemxe2x80x9d is used synonymously with xe2x80x9cprotected domainxe2x80x9d. The external signals may be the carrier of hostile executable code. Viruses, worms, triggers for trap-door and Trojan horse type software, and other forms of hostile signals use incoming data signals to enter a protected (target) information system environment. That is, the information being exchanged, including any hostile data, is contained in data sets carried by signals. The hostile data sets depend on the structural integrity of the incoming data stream or signal(s) for the necessary maintenance of its own structure. With the present invention, this structural integrity is disrupted, while the information carried by the data stream is preserved in the IDS. The InfoSec processes executed are isolation of external signals, and derivation of the information content of such signals and are referenced as a modified-read process. To achieve this, an xe2x80x9cinformation-preservingxe2x80x9d data transformation takes place in the IDS on these potentially corrupted incoming external data signals such as by processing an incoming signal containing an initial data set in such a manner as to extract the information in the initial data set, thus creating a signal having a different data set, and, thereafter, transmitting the different data sets to the host domain. Such processing includes converting the type and/or format of signals such as converting a telephone signal to a T.V. signal or converting an analog signal to a digital signal.
The intermediate domain and the modified-read function which takes place therein form a protective screen for the internal or host system or domain, to which they are attached. The modified-read process does not require prior knowledge of a particular virus/worm, etc and is a universal eliminator of hostile executable code.
The IDS therefore is not a proxy-server or firewall which are vulnerable to software errors and/or compromise, and to unknown hostile executable code (i.e. new virus) penetration. The IDS is an incoming signal buffer and transformer and an outgoing signal filter. It is a hardware device that is scalable, that provides the special purpose domain for information data flow control. This special purpose domain is intermediate between the IDS""s host system, which it is protecting, and external systems.
It is important to note that generic IDS functions and architecture enforce the following for the systems/networks it is protecting:
a) immunity to penetration;
b) assurance that all traffic between the protected domain and the external domain enters the IDS;
c) no direct connections between the protected domain the external domain exist; and
d) only authorized information, as defined by local InfoSec policy is allowed to exit the IDS.
The IDS is a multi-function device acting as a firewall, a guard/filter, a network front-end, and hostile code (e.g. virus) eliminator. The IDS may also act as a host system file screen which is adapted to receive file information from the host system, screen new file information and thereafter update existing files in the host system.
The present invention is directed to a method and apparatus for enabling information to be exchanged between a protected system and an external information source wherein the information is contained in data sets which are carried by signals in such a manner that undesired data is prevented from reaching the protected system. The invention uses an intermediate domain computer hardware device which is connected between the external data source and the protected system so as to receive an initial data set including the information which may contain undesirable data transmitted from the external source. In the intermediate domain hardware, the signals containing the initial data set are processed to create a second data set in such a manner that the information in the initial data set, is extracted to thereby screen out undesirable data. Thereafter, the extracted information is passed to the protected system.
In the elementary version of the invention, the intermediate domain computer hardware device (the IDD) may be a network computer, a webtv unit, a single board computer (SBC), a laptop/notebook computer, other personal computer (or the like), or a specially designed chip which receives signals in any manner such as broadcast signals or signals from a conventional telephone line from an external domain site such as the internet or world wide web. The incoming signals to the hardware device are routed (via the IDD) to what is tantamount to a tv card associated with a PCI bus of a computer system. The intermediate/domain device (IDD) in the form of the webtv system transforms the incoming signals. Any virus contained in the original signals can not survive the transformation of the signal format from the signals originally received, (such as by way of the telephone line), to the video signals at the tv-card and thus the card supplies extracted information to a connected computer which may be a personal computer.
As a reduced function (manual) embodiment of the elementary system, signals from the computer hardware device such as in a webtv system may be conveyed to a conventional printer wherein the signals are converted or transformed into a printed format which may be preserved. By taking the printed format and transforming the printed format into signals, such as by scanning, the information can be provided from the printer to the input of a PC such that only the extracted information without any viruses is passed to the personal computer or host system. In both the foregoing scenarios, the virus (or other forms of hostile code) can not survive the signal transformation within the intermediate domain system.
As mentioned, as opposed to using the webtv unit, a single board computer, laptop or notebook computer may be utilized to act as the intermediate domain device. The laptop or single board computer is connected to receive a signal such as through a telephone line from the internet. The invention, however, is not limited in its application to single point or individual host or host systems. the host may be substantially any single receiving information processor including main frame computers, information networks including local and wide are networks (LANs and WANs) and the like. Also, the computer hardware of the IDS is not limited to single or individual computer elements but may be computer networks and systems.
Any contamination of the IDS"" intermediate domain from system error or hostile executable code from external domains, is easily corrected by a reset function, or a cold-boot from a clean boot-disk. For some applications, this could be a recommended periodic procedure. Thus, the initial data set including any hostile executable code data is deleted from the intermediate domain after the information has been extracted. The IDS architecture insures that only data that has gone through a modified-read process enters the host (protected) system.
In another embodiment of the invention, the IDS is used to safely update files stored in the host system. In this embodiment, a file from the host is loaded to the IDS. The IDS also receives information signals from the external domain and processes the signals in a modified-read to thereby convert the signal to change an initial data set to a second data set in such a manner as to extract the information from the second data set and updates the file loaded from the host and thereafter forwards the safely updated file to the host. In this manner all updating of files is done in a manner in which the host files can not be compromised.
In yet another embodiment, the invention provides a screening of all outgoing signals from the host or protected system to the IDS so as to ensure that only permitted information is transmitted.
It is the primary object of the present invention to provide a method and apparatus which protects a host system from contamination by preventing external signals from entering the protected host system permitting safe xe2x80x9cinformationxe2x80x9d exchange between the host and possibly hostile external domains and, in some embodiments, also preventing inadvertent and/or unauthorized release of data from the host system.
These and additional capabilities, utility, and attainments of the present invention, should become apparent to those skilled in the art, upon reading of the following detailed description when taken in conjunction with the drawings wherein there is shown and described illustrative embodiments of the invention.